@miadi/connector 0.1.17 → 0.1.18

package/dist/server.d.ts

@@ -29,4 +29,4 @@ export declare function createConnectorApp(config: ConnectorConfig, deps: Connec
     provider: MiadiOAuthProvider;
     ledger: Ledger<ConnectorRecord>;
 };
-export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.\n- A mission is revised, never re-requested: to change a run or work proposal that still awaits a decision, call revise_pending_request with its id and the version you read (expected_version). It keeps one id, one approval page and one card; get_request_history shows every version. A new request_authorized_run or propose_work is for a new mission only. Requests made earlier as separate versions are joined with supersede_pending_requests, naming their exact ids, only when the person names or confirms them.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";
+export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nEvery tool is offered on every connection. A client that loads tools on demand shows only those its last tool search matched: a tool you do not see is not missing. Search for it by its exact name, get_capabilities first, before telling the person a tool is absent. The main reads are get_capabilities, get_context, search, fetch, list_records, list_sessions, get_session, review_lookup, read_episode_file and show_decisions.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.\n- A mission is revised, never re-requested: to change a run or work proposal that still awaits a decision, call revise_pending_request with its id and the version you read (expected_version). It keeps one id, one approval page and one card; get_request_history shows every version. A new request_authorized_run or propose_work is for a new mission only. Requests made earlier as separate versions are joined with supersede_pending_requests, naming their exact ids, only when the person names or confirms them.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";

package/dist/server.js

@@ -15,7 +15,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { mcpAuthRouter, createOAuthMetadata, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { MiadiOAuthProvider, SCOPES, emptyOAuthState } from "./oauth.js";
+import { MiadiOAuthProvider, SCOPES, SCOPE_CONTRIBUTE, SCOPE_READ, emptyOAuthState } from "./oauth.js";
 import { registerApprovalRoutes } from "./approve.js";
 import { DecisionTokens } from "./decisions.js";
 import { JsonFile, Ledger, ensureStateDir, statePaths } from "./store.js";
@@ -90,11 +90,23 @@ export function createConnectorApp(config, deps) {
     };
     registerApprovalRoutes(app, approvalDeps);
     const decisionTokens = new DecisionTokens(config.stateDir);
-    const auth = requireBearerAuth({
+    const bearer = requireBearerAuth({
         verifier: provider,
-        requiredScopes: ["miadi:read"],
+        requiredScopes: [SCOPE_READ],
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
     });
+    // A 401's scope is the list a client asks for at sign-in (MCP scope selection,
+    // step 1). Claude asks for exactly that list, so naming only miadi:read gave
+    // every Claude sign-in read alone. /mcp still requires only miadi:read; the
+    // sign-in page lets the person leave contributions off.
+    const asked = `scope="${[SCOPE_READ, SCOPE_CONTRIBUTE].join(" ")}"`;
+    const auth = (req, res, next) => {
+        const set = res.set.bind(res);
+        res.set = ((field, value) => field === "WWW-Authenticate" && typeof value === "string"
+            ? set(field, value.replace(/scope="[^"]*"/, asked))
+            : set(field, value));
+        bearer(req, res, next);
+    };
     const handle = async (req, res) => {
         const ctx = {
             config,
@@ -143,6 +155,8 @@ export const INSTRUCTIONS = `Miadi is a relational software factory: agent sessi
 
 Start with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.
 
+Every tool is offered on every connection. A client that loads tools on demand shows only those its last tool search matched: a tool you do not see is not missing. Search for it by its exact name, get_capabilities first, before telling the person a tool is absent. The main reads are get_capabilities, get_context, search, fetch, list_records, list_sessions, get_session, review_lookup, read_episode_file and show_decisions.
+
 Rules every tool keeps:
 - Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.
 - Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.

package/dist/tools.js

@@ -231,7 +231,7 @@ export function registerTools(server, ctx) {
     // ── reads ──────────────────────────────────────────────────────────────
     server.registerTool("get_capabilities", {
         title: "What this connector can do for you",
-        description: "The capability handshake: who you are signed in as, your Miadi tier and scopes, every tool with its status (live, needs_approval, write_tier), the services reached and the five circles. Call this first.",
+        description: "Start here with the Miadi connector. The capability handshake: who you are signed in as (who am I), your Miadi tier and scopes, the full list of Miadi tools with each one's status (live, needs_approval, write_tier), the services reached and the five circles. Call this first.",
         inputSchema: {},
         annotations: READ,
     }, wrap(async (_args, extra) => {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.17";
+export declare const VERSION = "0.1.18";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.17";
+export const VERSION = "0.1.18";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",